NetFlow-Lite and nProbe: a Tutorial

Posted · Add Comment

Today we have held a webinar about NetFlow-Lite with both Cisco and Plixer. Subscribers of this blog should know by now what is NetFlow-Lite and why nProbe is necessary to exploit this technology. Nevertheless you might be interested to know more about NetFlow-Lite, both in terms of features and usage scenarios. Below you can find […]

Invitation to NetFlow-Lite Webinar

Posted · Add Comment

As most of you know, nProbe has recently added NetFlow-Lite support in 6.5 release. NetFlow-Lite is a protocol that brings you visibility into switched networks, similar to what NetFlow “classic” is doing on routed networks. As this technology is pretty new, perhaps you might be interested in hearing more about it right from the source. […]

Using nProbe as NetFlow-Lite Cache

Posted · Add Comment

As previously stated on this blog, we have worked tightly with Cisco as nProbe has been selected as reference implementation for NetFlow-Lite flow conversion. Although NetFlow-Lite support has been added to nprobe since version 6.1.4 and it’s available on all supported platforms (both Unix and Windows), with nProbe 6.5 (just released) we have moved NetFlow-Lite […]

Going beyond RSS (Receive-Side Scaling)

Posted · Add Comment

When RSS was introduced some years ago, operating systems had the chance to scale also when handling network packets as RSS allowed incoming packets to be distributed across processor cores. Unfortunately RSS uses a one-way hash, that while distributes packets heavenly across queues, it has some drawbacks. The main one is that if you have […]

Packet Capture Performance at 10 Gbit: PF_RING vs TNAPI

Posted · Add Comment

Many of you are using PF_RING and TNAPI for accelerating packet capture performance, but have probably not tested the code for a while. In the past month we have tuned PF_RING performance and squeezed some extra packets captured implementing the quick_mode in PF_RING. When you do insmod pf_ring.ko quick_mode=1, PF_RING optimizes its operations for multi-queue […]

Power to see all

Posted · Add Comment

Almost a decade ago Dr Ian Graham was in Europe for a series of conferences and I have met him in person along with other people from Politecnico di Torino, that were developing winpcap (one of the key guys of the group, Loris Degioanni, at that time was visiting Endace, thus was not present at […]